Loading patterns…
Record every significant action to an append-only log that can be inspected but not altered. Essential for compliance, incident response, and answering 'who changed this and when?'
Rendering diagram…
Use an immutable audit trail whenever you need to answer:
Compliance frameworks (SOX, HIPAA, SOC 2, GDPR) all require some version of this. Even without regulation, incident response is miserable without it.
Every significant action — state change, permission grant, record view, approval — emits an audit event to an append-only store. The event includes: who (actor), what (action + target), when (timestamp), how (request ID, IP), and the before/after state where applicable.
"Immutable" means writes are only inserts. Updates and deletes aren't just discouraged — they're prevented by storage design (WORM storage, blockchain, or an append-only table with no UPDATE/DELETE grants).
"Immutable" includes retention. A log that quietly rolls off after 90 days isn't an audit trail; it's a short-term buffer. Set retention to match your longest audit horizon.
Not everything needs an audit event. Start with: authentication, privileged-data access, state changes to regulated records, approvals, permission changes, admin actions. Too many events = noise. Too few = gaps.
Every event should have: id, timestamp, actor, actor_type (user/service), action, target, target_type, outcome, before, after, request_id, ip, user_agent. Consistency makes queries sane.
If the audit write fails after the action succeeds, you have an action with no audit. Options: two-phase commit with the log, write audit first and the action second with compensation on failure, or use a transactional outbox to the log.
Grant the app INSERT-only on the table. No UPDATE, no DELETE. If the app is ever compromised, the attacker can add events but not erase them. Route reads through a separate role.
Admins and auditors need to search by actor, target, action, time range. A slow query here is a stalled investigation. Index appropriately; archive older events to a query-friendly cold store.
Periodically review who has access to what, confirm it's still needed, and revoke what isn't. Kills the slow-drip accumulation of stale permissions that turn into audit findings.
Externalize complex branching logic — pricing tiers, eligibility rules, routing decisions — into a readable table that business users can maintain without a developer in the loop.
Enforce mandatory review and documentation at specific points in a process to meet regulatory, legal, or internal policy requirements. Non-negotiable gates that cannot be bypassed.